Valimail Enforce - Unusual Rate of Configuration Changes or User Additions

Back


Id	3cbb78d9-81ac-42c9-b3cd-7e6baea7d9ff
Rulename	Valimail Enforce - Unusual Rate of Configuration Changes or User Additions
Description	This query searches for a single user performing more than 3 configuration changes or user additions within a 1-hour window on any domain. An unusual burst of changes may indicate a compromised admin account, unauthorized automation, or insider threat.
Severity	Medium
Tactics	Impact DefenseEvasion PrivilegeEscalation
Techniques	T1562 T1531 T1078
Required data connectors	ValimailEnforce
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ValimailEnforce/Analytic%20Rules/ValimailEnforce_UnusualChangeRate.yaml
Version	1.0.0
Arm template	3cbb78d9-81ac-42c9-b3cd-7e6baea7d9ff.json

KQL

let threshold = 3;
let timeWindow = 1h;
ValimailEnforceEvents_CL
| where EventCategory in (
    "DMARCPolicy",
    "SPFConfiguration",
    "DKIMConfiguration",
    "DomainManagement",
    "UserManagement"
  )
| summarize
    ChangeCount       = count(),
    HighValueCount    = countif(IsHighValueEvent == true),
    Domains           = make_set(Subject),
    DomainCount       = dcount(Subject),
    Actions           = make_set(EventType),
    Categories        = make_set(EventCategory),
    FirstSeen         = min(PerformedAt),
    LastSeen          = max(PerformedAt)
  by User, bin(PerformedAt, timeWindow)
| where ChangeCount > threshold
| extend
    AccountName   = tostring(split(User, "@")[0]),
    AccountDomain = tostring(split(User, "@")[1]),
    DomainName    = tostring(Domains[0]),
    ChangesPerMin = round(todouble(ChangeCount) / 60.0, 2)

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountName
  - identifier: UPNSuffix
    columnName: AccountDomain
- entityType: DNS
  fieldMappings:
  - identifier: DomainName
    columnName: DomainName
name: Valimail Enforce - Unusual Rate of Configuration Changes or User Additions
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ValimailEnforce/Analytic%20Rules/ValimailEnforce_UnusualChangeRate.yaml
triggerOperator: gt
status: Available
queryPeriod: 1h
requiredDataConnectors:
- connectorId: ValimailEnforce
  dataTypes:
  - ValimailEnforceEvents_CL
tactics:
- Impact
- DefenseEvasion
- PrivilegeEscalation
query: |
  let threshold = 3;
  let timeWindow = 1h;
  ValimailEnforceEvents_CL
  | where EventCategory in (
      "DMARCPolicy",
      "SPFConfiguration",
      "DKIMConfiguration",
      "DomainManagement",
      "UserManagement"
    )
  | summarize
      ChangeCount       = count(),
      HighValueCount    = countif(IsHighValueEvent == true),
      Domains           = make_set(Subject),
      DomainCount       = dcount(Subject),
      Actions           = make_set(EventType),
      Categories        = make_set(EventCategory),
      FirstSeen         = min(PerformedAt),
      LastSeen          = max(PerformedAt)
    by User, bin(PerformedAt, timeWindow)
  | where ChangeCount > threshold
  | extend
      AccountName   = tostring(split(User, "@")[0]),
      AccountDomain = tostring(split(User, "@")[1]),
      DomainName    = tostring(Domains[0]),
      ChangesPerMin = round(todouble(ChangeCount) / 60.0, 2)
description: |
  This query searches for a single user performing more than 3 configuration changes or user
  additions within a 1-hour window on any domain. An unusual burst of changes may
  indicate a compromised admin account, unauthorized automation, or insider threat.
severity: Medium
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: 1d
    groupByEntities:
    - Account
    enabled: true
    matchingMethod: Selected
    reopenClosedIncident: false
  createIncident: true
id: 3cbb78d9-81ac-42c9-b3cd-7e6baea7d9ff
triggerThreshold: 0
queryFrequency: 1h
alertDetailsOverride:
  alertDescriptionFormat: |
    User '{{User}}' made {{ChangeCount}} configuration changes across {{DomainCount}} domain(s) within one hour.
  alertDisplayNameFormat: Unusual change rate by {{User}}, {{ChangeCount}} changes in 1h across {{DomainCount}} domain(s)
version: 1.0.0
relevantTechniques:
- T1562
- T1531
- T1078

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/3cbb78d9-81ac-42c9-b3cd-7e6baea7d9ff')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/3cbb78d9-81ac-42c9-b3cd-7e6baea7d9ff')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "User '{{User}}' made {{ChangeCount}} configuration changes across {{DomainCount}} domain(s) within one hour.\n",
          "alertDisplayNameFormat": "Unusual change rate by {{User}}, {{ChangeCount}} changes in 1h across {{DomainCount}} domain(s)"
        },
        "alertRuleTemplateName": "3cbb78d9-81ac-42c9-b3cd-7e6baea7d9ff",
        "customDetails": null,
        "description": "This query searches for a single user performing more than 3 configuration changes or user\nadditions within a 1-hour window on any domain. An unusual burst of changes may\nindicate a compromised admin account, unauthorized automation, or insider threat.\n",
        "displayName": "Valimail Enforce - Unusual Rate of Configuration Changes or User Additions",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountName",
                "identifier": "Name"
              },
              {
                "columnName": "AccountDomain",
                "identifier": "UPNSuffix"
              }
            ]
          },
          {
            "entityType": "DNS",
            "fieldMappings": [
              {
                "columnName": "DomainName",
                "identifier": "DomainName"
              }
            ]
          }
        ],
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByEntities": [
              "Account"
            ],
            "lookbackDuration": "P1D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ValimailEnforce/Analytic%20Rules/ValimailEnforce_UnusualChangeRate.yaml",
        "query": "let threshold = 3;\nlet timeWindow = 1h;\nValimailEnforceEvents_CL\n| where EventCategory in (\n    \"DMARCPolicy\",\n    \"SPFConfiguration\",\n    \"DKIMConfiguration\",\n    \"DomainManagement\",\n    \"UserManagement\"\n  )\n| summarize\n    ChangeCount       = count(),\n    HighValueCount    = countif(IsHighValueEvent == true),\n    Domains           = make_set(Subject),\n    DomainCount       = dcount(Subject),\n    Actions           = make_set(EventType),\n    Categories        = make_set(EventCategory),\n    FirstSeen         = min(PerformedAt),\n    LastSeen          = max(PerformedAt)\n  by User, bin(PerformedAt, timeWindow)\n| where ChangeCount > threshold\n| extend\n    AccountName   = tostring(split(User, \"@\")[0]),\n    AccountDomain = tostring(split(User, \"@\")[1]),\n    DomainName    = tostring(Domains[0]),\n    ChangesPerMin = round(todouble(ChangeCount) / 60.0, 2)\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion",
          "Impact",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1078",
          "T1531",
          "T1562"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}